Peculiarities in HP supplied S/SX and G/GX ROM dumps

[Jonathan Busby]

(03-26-2019 05:32 PM)Giuseppe Donnini Wrote:  You're absolutely right! Some time ago, when I wrote my own HP-48 decompiler/disassembler to study the ROM (especially the hidden parts of it), I stumbled over the same problem. At first, I believed I had found 64 bytes of hidden ROM underneath the MMIO device. After all, the region below the bankswitcher (#7F000h-#7FFFFh) is not entirely empty either, so it was not completely unreasonable to think this was genuine ROM code. But soon enough I found out that I was wrong in my assumption and I ended up patching zeros over the area #00100h - #00139h to avoid getting strange results while disassembling in the vicinity of that region.

I could never make sense of it, but I think you came up with a clever explanation. At least there can be little doubt that the nibbles stem from an actual MMIO chip, because, if I remember correctly, the suspicious successions of 3's exactly correspond to the default positions of write-only hardware registers.

Indeed! I know from my research that the HP48 self test routines move the hardware regs out of the way before computing the ROM CRC. If one checks the ROM CRC check word which is a 4-nibble CRC at the end of IROM, then one gets :

Quote:$ xxd -c 1 -l 2 -s +524286 gxrom-r.bin
0007fffe: b1 .
0007ffff: f0 .

The above is incorrect if one doesn't zero out the 64 nibs starting at #100 . It would seem that the authors of most of the 48 emulators have known about this problem and the emulators must patch the ROM dump, or something similar, or else, during the IROM self test, one would get an error.

Regards,

Jonathan